CII Releases Guidance on Data Privacy for Vulnerable Customers

• •CII's new guidance helps firms manage vulnerability-related data under UK GDPR.
• •The guide aims to eliminate the misconception that data protection laws prevent support for vulnerable customers.
• •Research indicates over half of UK adults may be vulnerable, highlighting the need for effective data management.

The Chartered Insurance Institute (CII) published a guide on June 17, 2026, to help insurance and finance firms manage customer vulnerability-related data in compliance with UK data protection laws. The guide aims to alleviate concerns that data protection regulations hinder support for vulnerable clients, emphasizing that firms can collect and use such data responsibly. It identifies three key purposes for processing this data: to provide support, meet reporting requirements, and improve products and services. The guidance was launched following a joint statement from the FCA and the Information Commissioner's Office, which clarified that UK data protection laws do not prevent firms from achieving good consumer outcomes. The CII's initiative comes as research indicates that about 52% of UK adults exhibit characteristics of vulnerability, necessitating a systematic approach to data management in the sector.